Riskcovery

CVE-2021-36193

State
Published
Severity
6.3 Medium
Published
Feb 2, 2022
Updated
Jan 13, 2026
Reserved
Jul 6, 2021

Read the record on cve.org

Description

Multiple stack-based buffer overflows in the command line interpreter of FortiWeb before 6.4.2 may allow an authenticated attacker to achieve arbitrary code execution via specially crafted commands.

Scores

CVSSScoreVectorSource
3.16.3 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:Cfortinet

Weaknesses

  • CWE-121 Execute unauthorized code or commands

Affected Products

ProductVersions
FortiFoneFortinet
  • 3.0.0 through 3.0.11Affected
FortiADCFortinet
  • 7.0.0Affected
  • 6.2.0 through 6.2.2Affected
  • 6.1.0 through 6.1.6Affected
  • 6.0.0 through 6.0.4Affected
  • 5.4.0 through 5.4.5Affected
  • 5.3.0 through 5.3.7Affected
  • 5.2.0 through 5.2.8Affected
  • 5.1.0 through 5.1.7Affected
  • 5.0.0 through 5.0.4Affected
FortiMailFortinet
  • 7.0.0 through 7.0.2Affected
  • 6.4.0 through 6.4.6Affected
  • 6.2.0 through 6.2.8Affected
  • 6.0.0 through 6.0.12Affected
  • 5.4.0 through 5.4.12Affected
FortiDDoSFortinet
  • 5.7.0Affected
  • 5.6.0 through 5.6.1Affected
  • 5.5.0 through 5.5.1Affected
  • 5.4.0 through 5.4.3Affected
  • 5.3.0 through 5.3.2Affected
  • 5.2.0Affected
  • 5.1.0Affected
  • 5.0.0Affected
  • 4.7.0Affected
  • 4.6.0Affected
  • 4.5.0Affected
  • 4.4.0 through 4.4.2Affected
FortiDDoS-FFortinet
  • 6.3.0Affected
  • 6.2.0 through 6.2.2Affected
  • 6.1.0 through 6.1.4Affected
FortiVoiceFortinet
  • 6.4.0 through 6.4.4Affected
  • 6.0.0 through 6.0.10Affected
FortiDDoS-CMFortinet
  • 5.5.0 through 5.5.1Affected
  • 5.4.0 through 5.4.3Affected
  • 5.3.0 through 5.3.1Affected
  • 5.2.0Affected
  • 5.1.0Affected
  • 5.0.0Affected
  • 4.7.0Affected
FortiWebFortinet
  • 6.4.0 through 6.4.1Affected
  • 6.3.0 through 6.3.15Affected
FortiRecorderFortinet
  • 6.4.0 through 6.4.2Affected
  • 6.0.0 through 6.0.10Affected
  • 2.7.0 through 2.7.7Affected
  • 2.6.0 through 2.6.3Affected
FortiNDRFortinet
  • 1.5.0 through 1.5.3Affected
  • 1.4.0Affected
  • 1.3.0 through 1.3.1Affected
  • 1.2.0Affected
  • 1.1.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.